Add the remaining nine DEF CON 34 findings - #10
Merged
Conversation
NocoBase (four), Activepieces (two), Flowise, Dify, and Apache Airflow, completing the fourteen findings the talk and whitepaper cover. Two details came out of verification rather than the source table: - The Flowise validator bypass now carries CVE-2026-73487, assigned after the whitepaper was compiled. The record is keyed on the CVE rather than GHSA-w7x8-q2gp-5cgg, which moves to refs.ghsa. - The two Activepieces CVEs credit their co-reporters. Appendix B names them as co-reports rather than duplicates, and both advisories list all three as reporters. GHSA-42wx-r3jw-6c5h (draft) and GHSA-f92q-4wx5-r997 (triage) are still not public, so those two records are keyed on their Endor ids and name the advisory in prose, the same treatment as the two embargoed Langflow records. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the DEF CON 34 set: NocoBase (four), Activepieces (two), Flowise, Dify, and Apache Airflow. With the five from #8 this covers all fourteen findings the talk and whitepaper document.
ENDOR-VUL-2026-0105CVE-2026-73487ENDOR-VUL-2026-16041checkSQLCVE-2026-41641CVE-2026-41640ENDOR-VUL-2026-16044CVE-2026-73083CVE-2026-73081dag_run.confCVE-2026-30898All nine carry the blog as
blog:, the whitepaper asrefs.whitepaper,talks: [hacking-your-life-with-ai], and their reported dates. No schema changes — these fit the shape #8 and #9 established.Two details that came out of verification
The Flowise advisory now carries CVE-2026-73487, assigned after the whitepaper was compiled (GHSA published 2026-07-29, NVD ingested 2026-08-13; the source table lists only the GHSA). Per this repo's identifier precedence the CVE is the record, so
GHSA-w7x8-q2gp-5cggmoves torefs.ghsa.The two Activepieces CVEs credit their co-reporters —
CVE-2026-73083: Aviral2642, q1uf3ng;CVE-2026-73081: kodareef5, Aviral2642. Appendix B names these as co-reports rather than duplicate reports, and both advisories list all three asreporter.Records without a citable advisory
GHSA-42wx-r3jw-6c5h(draft) andGHSA-f92q-4wx5-r997(triage) are not public, so those two are keyed on their Endor ids and name the advisory in prose, the same treatment as the embargoed Langflow records. Dify was closed working-as-designed with no advisory and no vendor score, so itscvssis absent.Scores worth a second look
CVE-2026-41640is recorded at 7.5, the score published with the advisory. NVD's own primary analysis scores it 8.8. Noted in the record body.CVE-2026-30898is recorded at 8.8, the CVSS v3.1 base score on the CVE record. The ASF assesses the issue as Low. Noted in the record body.CVE-2026-73487is recorded at 9.3 (v3.1). NVD carries a v4.0 score of 9.0 from VulnCheck, and Appendix B quotes the v4.0 figure; every other record here uses v3.1.Verification
All 19 records render, every detail page builds, and the five cross-record links between companion findings resolve.
🤖 Generated with Claude Code